[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQgpMMJ1So3Gx-X6A4xDgpy6_MNxJaxBcuIRLP6Cv35w":3},{"article":4,"iocs":49,"watch_terms":66,"solutions":67,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f603eea9-bdca-44ee-84bd-f8484fabb8f1","Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products","citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products-283a88","Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks. The post Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products appeared first on SecurityWeek.","Citrix, Fortinet, and Ivanti have collectively released patches for 29 vulnerabilities across their product lines. These include critical-severity flaws that could lead to authentication bypass, arbitrary code execution, and sensitive information leaks. Notably, Ivanti addressed an exploited zero-day in its Connect Secure VPN, which involved chaining two underlying bugs.","Citrix, Fortinet, and Ivanti patch 29 vulnerabilities, including critical flaws and an exploited zero-day.","https:\u002F\u002Fwww.securityweek.com\u002Fcitrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002Fsoftware-vulnerability-patch-update.jpg","2026-10-14T07:26:35+00:00","2026-10-14T08:00:14.227842+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Citrix","vendor",{"name":21,"type":19},"Fortinet",{"name":23,"type":19},"Ivanti",{"name":25,"type":26},"Workspace App for Windows","product",{"name":28,"type":26},"XenServer",{"name":30,"type":26},"FortiSIEM","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60,63],{"type":51,"value":52,"context":53},"cve","CVE-2026-106173","Fortinet critical vulnerability allowing unauthenticated attackers to execute arbitrary code.",{"type":51,"value":55,"context":56},"CVE-2026-107656","Fortinet critical vulnerability allowing unauthenticated attackers to bypass authentication.",{"type":51,"value":58,"context":59},"CVE-2026-104935","Ivanti zero-day vulnerability in Connect Secure, exploited in the wild.",{"type":51,"value":61,"context":62},"CVE-2026-109412","Ivanti critical vulnerability in Neurons Patch for Intune allowing sensitive authentication information leaks.",{"type":51,"value":64,"context":65},"CVE-2026-106042","Ivanti critical vulnerability in Xtraction allowing redirection of requests and capture of credentials.",[18,21,23],{"controls":68,"vendors":151},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":99,"product_name":123,"url":124,"description":125},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":48,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,143],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":139,"product_name":140,"url":141,"description":142},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[152,157,161],{"slug":153,"name":18,"logo_path":154,"roles":155},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[156],"affected",{"slug":158,"name":21,"logo_path":159,"roles":160},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[156],{"slug":162,"name":23,"logo_path":163,"roles":164},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[156],{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":179},"critical-patches-released-for-citrix-fortinet-and-ivanti-including-actively-exploited-zero-day","Critical Patches Released for Citrix, Fortinet, and Ivanti — Including Actively Exploited Zero-Day","Vendors Citrix, Fortinet, and Ivanti collectively patched 29 vulnerabilities, including critical flaws enabling authentication bypass, remote code execution, and data leakage. Most alarming is an actively exploited zero-day in Ivanti Connect Secure VPN, where attackers chained two bugs together to achieve compromise — underscoring that unpatched network edge devices are prime targets. The fact that this zero-day was already being exploited in the wild at the time of disclosure means organizations that delayed patching were exposed. Network appliances like VPNs and firewalls are especially high-value targets because they sit at the perimeter and often have privileged access to internal systems. Prompt patching of these devices is not optional — it is a fundamental security baseline.",[170,171,172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","ITIL: Change and Release Management","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]